50. DFN Betriebstagung

Transcription

1 50. DFN Betriebstagung IPS Serial Clustering in 10GbE Environment Tuukka Helander, Stonesoft Germany GmbH Frank Brüggemann, RWTH Aachen Slide 1

2 Agenda Introduction Stonesoft clustering Firewall parallel clustering How does it work StoneGate IPS Operating principle Architecture The challenge with 10GbE Serial clustering Process virtualization Conclusion Slide 2

3 Secure Information Flow Global Company Customer Focus Innovation A global network security company, in business since 1990 Listed on the OMX Nordic Stock Exchange Helsinki Corporate HQ in Helsinki, Finland Operations in USA, EMEA and Asia Customers in more than 60 countries Focus on enterprise customers requiring advanced network security and alwayson connectivity Global 24/7 support Integrated network security and business continuity solutions R&D centers in Finland and France Multiple patents for core technologies Slide 3

4 StoneGate Security Platform StoneGate Overview Slide 4

5 Firewall Parallel Clustering RWTH Uplink - Parallel clustering at 10 GbE how it started Prospect of bandwidth demand beyond 1 GbE start of 2006 Already existing Stonesoft cluster fully deployed in 1 GbE then Testing phase in mixed environment with one 10 GbE machine Full migration to 10 GbE in August 2006 Since then, continuous upgrades of server hardware Embedded into HA, disaster resilient architecture. Slide 5

6 Use Case RWTH Aachen RWTH Uplink - Parallel clustering at 10 GbE today Uplink capacity 10 Gbit/s with another 10 Gbit/s failover link via BGP MED attribute FW cluster embedded into Cisco Catalyst 650x VSS dual chassis systems Deployed over disjoint locations for disaster resiliency FW cluster consists of IBM servers (partially consolidated into blades) PCI express architecture Xeon 3.00 GHz multicore CPUs Slide 6

7 Use Case RWTH Aachen RWTH Uplink Fine tuning clustering mode Packet dispatch mode: FW cluster is configured with a unicast IPv4 address and unicast MAC address Master node is elected by internal algorithm Interface of master node answers to arp requests with CVI mac address traffic is initially routed towards this interface Traffic is redirected by master node to according to load etc. Multicast mode: FW cluster is configured with a unicast IPv4 address and multicast MAC address (I/G bit set) Static arp entries and mac table entries required on adjacent switches Traffic is flooded to every node of the cluster Internal algorithm decides whether a node processes a flow or not Found to be superior to dispatch mode with regard to scalability, stability, performance. Slide 7

8 Use Case RWTH Aachen RWTH Uplink Configuring Multicast LB - Cluster Slide 8

9 Use Case RWTH Aachen RWTH Uplink Configuring Multicast LB Cisco Catalyst c6k-xwin#show conf... ip route ip route ip route arp ARPA... mac-address-table static vlan 108 interface TenGigabitEthernet1/1 TenGigabitEthernet1/3 TenGigabitEthernet2/2 TenGigabitEthernet2/3 Slide 9

10 StoneGate Clustering Technology Load balancing principles Dynamic load balancing is based on a fast algorithm that takes IP header information as input: Source IP address Destination IP address Ports may be added to load-balancing decision if more granularity is needed Don t use for fun, since excessive load balancing decisions can add overhead Load balancing filter sits between the network interface card driver and the application Initial capacity and current load of each node is also taken into account for the balancing decision 7 Application 6 Presentation 5 Session 4 Transport 3 Network Load Balancing Filter 2 Data Link 1 Physical Slide 10

11 StoneGate Clustering Technology Node Failover and New Node in Cluster When a node fails or a new node comes online, the load balancing filter is recalculated and the load is redistributed Heartbeat protocol detects the failed nodes or new nodes Load redistribution is recalculated relative to individual node performance and node availability In case of node failure, the connection is moved to a healthy node A new node joining a cluster begins accepting new connections immediately Slide 11

12 StoneGate IPS Operating Principle Network-based Intrusion Protection System Protects vulnerable applications and operating systems from network attacks against Server vulnerabilities Client vulnerabilities Transparent access control within network segments Security policies for ethernet, network and transport layers Supports both IPv4 and IPv6 Protects services from Denial-of-Service (DoS) attacks Provides a security monitoring view into the network traffic Slide 12

13 StoneGate IPS Architecture Slide 13

14 The challenge with 10 Gbps environment Two major concerns Single StoneGate sensor appliance handles traffic only to 4 Gbps Future appliances might go up to 10 Gbps CPU usage focuses on interrupts from the network interface cards Intel chipsets have doubled the PCIe bandwidth Each NIC separates RX and TX flows Slide 14

15 Inline IPS Serial Cluster Two benefits Boosts inline IPS inspection performance Only one of the sensor nodes in an IPS serial cluster inspects a connection Others are in bypass mode for the same connection Load balancing decision based on IP addresses No state synchronization needed between the nodes Providing HA for network traffic inspection If a node fails it switches to a hardware bypass state and load balancing filter is recalculated on rest of the nodes Bypass NICs are mandatory Not a network HA solution Slide 15

16 Inline Serial Cluster Scalability Results from the R&D test lab Test setup: Appliance Deployment IPS version SMC version IPS-2000C Serial Inline IPS cluster Dyn update 224 Smartbits LAN-3321A module with two 1GB ports Test description: bidirectional UDP streams 250 flows/direction used (IP-IP pairs) Burst duration 30 sec System policy in use Slide 16

17 Process Virtualization Utilizing the cores Load balancing between the CPU cores IPS sensor process sliced to several virtual entities Intel 10GbE and ixgbe capabilities in use Multi-queued flows balanced between all available cores Requires IPS version 5.0 Estimated availability Q2/2009 Slide 17

18 Conclusion 10GbE environment is possible Serial clustering Process virtualization Intel-based hardware Innovative software development from Stonesoft Slide 18

19 Slide 19